Wyndham, a giant in the hotel and resort industry, has acknowledged a cybersecurity incident. Previously, a well-intentioned security researcher discovered a vulnerability that could have allowed anyone to access customers' personal information.
A security researcher named Robert Wiggins from What Security has exclusively informed TechCrunch that they discovered a password in the source code of the Wyndham Android application, which allows access to the company's internal database. This database is hosted by the technology company Salesforce.
Wiggins indicates to TechCrunch that this credential exposed personal information, including customer names, email addresses, and Wyndham membership numbers. The database also stores customer login tokens (referred to as JWT), which allow customers to remain logged in within the application without having to re-enter their passwords repeatedly. The database also contains files and documents belonging to Wyndham.
According to Wiggins, this database contains millions of records, but he is unable to determine the exact number of customer records that have been exposed. Wyndham claims that its reward program has approximately 129 million registered members.
This researcher stated that Wyndham did not provide a channel for reporting security vulnerabilities, therefore they requested TechCrunch to assist in notifying the company. Shortly after TechCrunch contacted Wyndham's network security team, the exposed credentials were revoked, thereby preventing further access to the database.
"Our team has taken measures to address this issue," a spokesperson for Wyndham said to TechCrunch. "Our security team has not found any evidence of unauthorized access," the statement added, but did not provide further details on this claim.
When asked whether the company has technical means (such as server logs) to determine whether anyone accessed the customer database before issues were discovered at Wiggins, a Wyndham spokesperson did not respond.
TechCrunch also asked whether Wyndham plans to notify customers whose information has been exposed, or to disclose this matter to US regulatory authorities, such as filing a notice with the US Securities and Exchange Commission; for major cybersecurity incidents, listed companies are usually required to do so. Wyndham did not comment on this.
A Wyndham spokesperson also did not clarify how long the password had been embedded in their customers' applications, nor did they mention any plans the company has to provide a long-term fix for these applications.
Application and software developers usually avoid including passwords or credentials in publicly released software and applications—a practice known as "hardcoding"—because anyone who obtains a copy of the software can extract those passwords and use them to access the corresponding servers or databases. Given that such credentials can be easily misused by anyone, many cases of hardcoded credentials are automatically rated as having the highest level of vulnerability severity.
For Wiggins, this is the second time in two weeks that he has publicly discovered a hard-coded credential issue. Previously, he found an almost identical vulnerability in the application of Applebee, which led to the exposure of customer data. In both of these discoveries, Wiggins utilized AI tools; these tools are capable of scanning thousands of lines of decompiled application code per second, making it easier to identify simple security weaknesses such as hard-coded credentials.
When asked for his opinion on Wyndham's response, Wiggins told TechCrunch that he was glad the company had fixed this issue, but also pointed out that without knowledge of past activities, malicious individuals could potentially have leaked a large amount of customer personal information.
The company also did not state whether it plans to establish a vulnerability disclosure program to allow external security researchers and hackers to report security vulnerabilities privately.
Wendham's Chief Cybersecurity Officer, Michael Francess, in response to this incident, stated to TechCrunch that researchers can submit details of potential security issues through [ email protected ]. The company's spokesperson did not clarify whether there are plans to modify the website to allow researchers to send alerts to the company.
This is the latest known security incident involving Wyndham in recent years. In 2024, a security researcher discovered that computers at the check-in desks of several Wyndham hotels were running spyware that allowed remote access, which leaked screenshots of guests' records and reservation information to the open internet.
Not long after the report by TechCrunch, this spyware application pcTattletale, which was discovered on hotel computers, came under attack by hackers. A large amount of customer data stored within it was stolen, forcing its owner Bryan Fleming to close down the company. Fleming had previously resided in Michigan and was later arrested by federal authorities, and was convicted of producing, selling, and promoting illegal spyware.
